Loading story…
A major U.S. real estate company was targeted in a sophisticated cyberattack involving the emerging Tuoni command-and-control (C2) and red teaming framework. Threat actors, suspected of impersonating Microsoft Teams corporate contacts, lured an employee into executing a malicious PowerShell one-liner. This initiated a concealed PowerShell process that fetched a secondary script, which used steganography to hide the next-stage payload within a BMP image. The attack chain culminated in the in-memory execution of shellcode and the stealthy loading of TuoniAgent.dll, enabling remote control via the Tuoni C2 server. The attackers leveraged artificial intelligence-generated comments and modular code structure to enhance evasion and operational security.
The Tuoni C2 framework, originally designed for penetration testing and red team engagements, is freely available and has been abused in this incident for malicious purposes. Despite the advanced techniques employed—including AI-assisted code, steganography, and in-memory payload delivery—the intrusion was detected and thwarted by security researchers at Morphisec. The incident highlights the growing risk posed by the dual-use nature of red teaming tools and the increasing sophistication of social engineering and payload delivery methods targeting the real estate sector and beyond.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
In mid-November 2025, reporting based on Morphisec's findings publicly identified the newly emergent Tuoni red-teaming and command-and-control framework as part of the failed attack. Researchers also warned that attackers are increasingly combining AI-generated content, steganography, and in-memory execution to evade defenses.
During the attempted attack, Morphisec said it discovered and blocked the intrusion before the compromise succeeded. The incident was described as an unsuccessful cyberattack against the targeted real estate company.
In October 2025, attackers reportedly targeted a leading U.S. real estate firm by impersonating Microsoft Teams corporate contacts and socially engineering an employee into executing a malicious PowerShell one-liner. The intrusion chain used concealed PowerShell execution, BMP-based payload delivery, shellcode extraction, in-memory execution, inline C# compilation, and loading of TuoniAgent.dll tied to the Tuoni command-and-control framework.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used a mailbombing campaign and Microsoft Teams impersonation to trick an employee into downloading a malicious archive from a fake self-service portal, deploying a modular remote access trojan built on the Deno runtime. Researchers said the malware consisted of four heavily obfuscated JavaScript files—`app.js`, `back.js`, `helper.js`, and `webui.js`—that split functions across processes using Deno permission flags, established persistence through the `HKCU\Run` registry key, and communicated with a CloudFront-hosted WebSocket command-and-control endpoint to blend with legitimate traffic. The intrusion gave operators remote command execution through `cmd.exe`, used `conhost.exe --headless` to reduce visibility, and exposed loopback services that enabled TCP tunneling and internal network pivoting from the compromised host. Endpoint protection reportedly did not block the implant or its C2 traffic at launch, and detection came later during reconnaissance activity including LDAP and certificate-related queries, prompting recommendations to monitor Deno execution from user-writable paths, suspicious permission flags, loopback listeners, registry persistence, and correlations between external Teams calls and sudden email floods.
Jun 29, 2026
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026
Researchers disclosed **TwinLoot**, a previously undocumented Python-based malware framework that conducts command-and-control almost entirely through trusted Microsoft cloud services. Ontinue said the implant uses **SharePoint Online** and the **Microsoft Graph API** as a dead-drop C2 channel, abuses **Microsoft Teams** TURN relay infrastructure for interactive access, and routes traffic through the victim’s own **Microsoft Edge** browser to blend malicious activity into normal enterprise cloud usage. Investigators linked the activity to an ongoing campaign and assessed the likely initial access vector as a Microsoft Teams social-engineering lure in which an actor posing as IT support convinced a victim to run a PowerShell command. TwinLoot supports credential harvesting, arbitrary command execution, reconnaissance, screenshot capture, and reverse **SOCKS5** tunneling for pivoting and lateral movement. Its credential theft module presents a convincing fake Windows lock screen to capture passwords, while its persistence mechanism uses an offline-forged **`NTUSER.MAN`** mandatory profile hive without requiring administrative privileges, a technique researchers described as the first recorded malicious use in the wild of this Windows internals method. Analysts said the framework’s combination of Microsoft 365 dead-drop C2, Teams relay abuse, and headless browser transport is a first-of-its-kind design, and urged defenders to baseline normal SharePoint, Teams, and Graph API activity while monitoring OAuth applications, consent grants, and other anomalous cloud behavior.
Aug 22, 2026